Microsoft releases anti-POODLE Fix It

[andrew129260]

Non, Sorry if my post was suggesting that people are panicking here. I was not trying to say that.

Callender thank you for the additional links and info.

From everything I had personally read on the subject, (over 10 articles) all of them seemed to suggest the real danger with the flaw was over unsecured networks was the greatest risk. The thing is if the server side is compromised you have bigger things to worry about then just ssl3. TLS has its own huge share of security problems.

The fact is (ok my opinion) is the site operators will do there best to rectify the issue, and so will browsers. Right now I think you are more likely to be hit with a drive by download or rasomware threat then an ssl3 attack. Of course it could happen, but seeing as how Google discovered it and told everyone, it is less of a risk vs heartbleed.

Again, my opinion. I am not a security expert.

 

[Callender]

Poodle - what can users do?

@andrew129260

Well I'd tend to agree with you. The advice that I've seen suggests that for most users - the only action required is to use a patched and up to date browser and operating system. The rest is down to the server operators/ hosting providers. Eventually it will all be fixed!

 

[NoN]

@andrew129260, no problems...

As callender mentionned, now its up to operator. End-users have to do their best to protect their browsing experience too.

 

[sygnus21]

Non, Sorry if my post was suggesting that people are panicking here. I was not trying to say that.

I didn't think your post(s) suggested panic or that people were panicking. I think it's good that the alarm be raised as it gets people thinking about security. And that's always a good thing.

Is this a the end of the world panic situation, probably not... I plan to leave my SSL 3.0 enabled due to the fact its needed for my school work, but I'm also now aware there is a potential issue at stake.

In this case a raised alarm is better safe than sorry.

My two cents.

 

[NoN]

Since i am not using any kind of "internal" school or related to studying websites, but at larger scale ones, sure i'm caring more about security flaws on my main browser...Has some already said the use of another browser for special purposes could be wise too.
Its not the first time i saw myself browsing an online site and having difficulties (kind of slow connection?) that reminds me being driven by. People needs to be aware just for their safety, after it is the matter of choice, what you're doing at your own risk, yes, better safe than sorry, again.

 

[sygnus21]

Since i am not using any kind of "internal" school or related to studying websites,

What's an "internal" school?

Maybe I'm missing your point but every major university in the world has a net portion that students are required to login and use on a daily basis. And a lot of schools are starting to go paperless, even with books.

And just like "mainstream", universities are relying more and more on the internet and internet access, and many classes are broadcast on line. So yeah, we would be included in that "larger scale" and also take our security serious as well.

Just wanted to clarify.

 

[NoN]

Sorry, i meant by internal, related to school classes as you said. Of course it should not exclude those schools that have their own sites for students purposes and good on them going paperless. Larger scales was meaning more of those online payments websites which are very sensitive to SSL

 

[Anak]

Since i am not using any kind of "internal" school or related to studying websites,

What's an "internal" school?

Maybe I'm missing your point but every major university in the world has a net portion that students are required to login and use on a daily basis. And a lot of schools are starting to go paperless, even with books.

And just like "mainstream", universities are relying more and more on the internet and internet access, and many classes are broadcast on line. So yeah, we would be included in that "larger scale" and also take our security serious as well.

Just wanted to clarify.

Just courious Drew, does the requirement to log-in and use their site daily qualify as attendance?

 

[sygnus21]

@ Anak,

I can't say that it does as you don't always need to log in. However you would for activities such getting/reading the class syllabus, doing on-line class discussions, quizzes, written paper assignments, doc sharing. Stuff like that.

@ NoN,

Ok, I got it. Thanks. It just that your post threw me for a second. All good

 

[Anak]

Thanks Drew!

Steve